CVE-2016-10108

CRITICAL EXPLOITED NUCLEI

Western Digital MyCloud unauthenticated command injection

Title source: metasploit

Description

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.

Exploits (1)

metasploit WORKING POC EXCELLENT

by Erik Wynter, Steven Campbell, Remco Vermeulen · rubypoclinux

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/wd_mycloud_unauthenticated_cmd_injection.rb

View Code ZIP pw:eip

Nuclei Templates (1)

Western Digital MyCloud NAS - Command Injection

CRITICALby DhiyaneshDk

Shodan: http.favicon.hash:-1074357885

FOFA: icon_hash=-1074357885

References (3)

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html

[Exploit, Third Party Advisory] https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/95200

Scores

CVSS v3 9.8

EPSS 0.9110

EPSS Percentile 99.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-02-07

CWE

CWE-77

Status published

Products (1)

western_digital/mycloud_nas 2.11.142

Published Jan 03, 2017

Tracked Since Feb 18, 2026